the key is to know which tables and columns are containing the information you want, you can get these by requesting the information.schema database. When you have insufficient rights to access the information.schema database you can try two things, guess the names or brute force them.

in the end you want to inject a request like this:

UNION SELECT password FROM users where login_name='admin'--

there are several good sql injection tutorials out there which you can use for more information. good luck!

CISSP, CEH, ECSA, OSCP, OSWP, eCPPT, eWAPT

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...

wlandymore wrote:If I run:') AND (select * from information_schema)-- (((1=1

I get the error "table glocken_emil.information_schema doesn't exist" so it would appear that they have appended glocken_emil to all of the tables here. I guess that tells me a little bit about the structure...

hmm, from here you can go two ways: try to guess the correct information.schema tablename (which could be glocken_emil.information_schema) or try to guess other tables like glocken_emil.users.

come to think of it, the error gets me thinking, it looks like the query is being modified to access a table with the tablename 'glocken_emil.*'. again it has been a while but you can try to use the brute forcer in sqlmap (where you define the prefix as glocken_emil) and see if you can get some tablenames.

CISSP, CEH, ECSA, OSCP, OSWP, eCPPT, eWAPT

earning my stripes appears to be a road i must travel alone...with a little help of EH.net

Use "LIMIT 0,1" in the end of your original query to return only one (1) result from your "SELECT * FROM information_schema" sub-query.

Furthermore, -- (((1=1 seems incorrect.If you break out of a query with ' (apostrophe), you could something as simple as: AND 'a'='a . That will make the end of the query look like: 'a'='a', as it will append the "missing" apostrophe.

Using a comment like -- and then adding more data afterward seems a bit obscure, because either it (or other ways like #) works or you should avoid using it.

FYI I recommend you don't just use information_schema, but more specific queries like: information_schema.tables